]>
Commit | Line | Data |
---|---|---|
1 | package PVE::HTTPServer; | |
2 | ||
3 | use strict; | |
4 | use warnings; | |
5 | ||
6 | use PVE::SafeSyslog; | |
7 | use PVE::INotify; | |
8 | use PVE::Tools; | |
9 | use PVE::APIServer::AnyEvent; | |
10 | use PVE::Exception qw(raise_param_exc raise_perm_exc raise); | |
11 | ||
12 | use PVE::RPCEnvironment; | |
13 | use PVE::AccessControl; | |
14 | use PVE::CertCache; | |
15 | use PVE::Cluster; | |
16 | use PVE::API2Tools; | |
17 | ||
18 | use Data::Dumper; | |
19 | ||
20 | use base('PVE::APIServer::AnyEvent'); | |
21 | ||
22 | use HTTP::Status qw(:constants); | |
23 | ||
24 | sub new { | |
25 | my ($this, %args) = @_; | |
26 | ||
27 | my $class = ref($this) || $this; | |
28 | my $self = $class->SUPER::new(%args); | |
29 | ||
30 | $self->{rpcenv} = PVE::RPCEnvironment->init( | |
31 | $self->{trusted_env} ? 'priv' : 'pub', | |
32 | atfork => sub { $self->atfork_handler() }, | |
33 | ); | |
34 | ||
35 | return $self; | |
36 | } | |
37 | ||
38 | sub verify_spice_connect_url { | |
39 | my ($self, $connect_str) = @_; | |
40 | ||
41 | my $rpcenv = $self->{rpcenv}; | |
42 | $rpcenv->init_request(); | |
43 | ||
44 | my ($vmid, $node, $port) = PVE::AccessControl::verify_spice_connect_url($connect_str); | |
45 | ||
46 | return ($vmid, $node, $port); | |
47 | } | |
48 | ||
49 | sub generate_csrf_prevention_token { | |
50 | my ($username) = @_; | |
51 | return PVE::AccessControl::assemble_csrf_prevention_token($username); | |
52 | } | |
53 | ||
54 | sub auth_handler { | |
55 | my ($self, $method, $rel_uri, $ticket, $token, $api_token, $peer_host) = @_; | |
56 | ||
57 | my $rpcenv = $self->{rpcenv}; | |
58 | ||
59 | # set environment variables | |
60 | $rpcenv->set_user(undef); | |
61 | $rpcenv->set_language('C'); | |
62 | $rpcenv->set_client_ip($peer_host); | |
63 | ||
64 | eval { $rpcenv->init_request() }; | |
65 | raise("RPCEnvironment init request failed: $@\n") if $@; | |
66 | ||
67 | my $require_auth = 1; | |
68 | ||
69 | # explicitly allow some calls without auth | |
70 | if (($rel_uri eq '/access/domains' && $method eq 'GET') || | |
71 | ($rel_uri eq '/access/ticket' && ($method eq 'GET' || $method eq 'POST')) || | |
72 | ($rel_uri eq '/access/openid/login' && $method eq 'POST') || | |
73 | ($rel_uri eq '/access/openid/auth-url' && $method eq 'POST')) { | |
74 | $require_auth = 0; | |
75 | } | |
76 | ||
77 | my ($username, $age); | |
78 | ||
79 | my $isUpload = 0; | |
80 | ||
81 | if ($require_auth) { | |
82 | if ($api_token) { | |
83 | # the token-ID `<user>@<realm>!<tokenname>` is the user for token based authentication | |
84 | $username = PVE::AccessControl::verify_token($api_token); | |
85 | } else { | |
86 | die "No ticket\n" if !$ticket; | |
87 | ||
88 | ($username, $age, my $tfa_info) = PVE::AccessControl::verify_ticket($ticket); | |
89 | $rpcenv->check_user_enabled($username); | |
90 | ||
91 | if (defined($tfa_info)) { | |
92 | if (defined(my $challenge = $tfa_info->{challenge})) { | |
93 | $rpcenv->set_u2f_challenge($challenge); | |
94 | } | |
95 | die "No ticket\n" if ($rel_uri ne '/access/tfa' || $method ne 'POST'); | |
96 | } | |
97 | } | |
98 | ||
99 | $rpcenv->set_user($username); | |
100 | ||
101 | if ($method eq 'POST' && $rel_uri =~ m|^/nodes/([^/]+)/storage/([^/]+)/upload$|) { | |
102 | my ($node, $storeid) = ($1, $2); | |
103 | # CSRF check are omitted if $isUpload is set, so check user upload permission here | |
104 | my $perm = { check => ['perm', "/storage/$storeid", ['Datastore.AllocateTemplate']] }; | |
105 | $rpcenv->check_api2_permissions($perm, $username, {}); | |
106 | $isUpload = 1; | |
107 | } | |
108 | ||
109 | # Skip CSRF check for file upload (difficult to pass CSRF header with native html forms). | |
110 | # Also skip the check with API tokens, as one of the design goals of API tokens was to | |
111 | # provide stateless API access without requiring round-trips to get such CSRF tokens. | |
112 | # CSRF-prevention also does not make much sense outside of the browser context. | |
113 | if ($method ne 'GET' && !($api_token || $isUpload)) { | |
114 | my $euid = $>; | |
115 | PVE::AccessControl::verify_csrf_prevention_token($username, $token) if $euid != 0; | |
116 | } | |
117 | } | |
118 | ||
119 | return { | |
120 | ticket => $ticket, | |
121 | token => $token, | |
122 | userid => $username, | |
123 | age => $age, | |
124 | isUpload => $isUpload, | |
125 | api_token => $api_token, | |
126 | }; | |
127 | } | |
128 | ||
129 | sub rest_handler { | |
130 | my ($self, $clientip, $method, $rel_uri, $auth, $params) = @_; | |
131 | ||
132 | my $rpcenv = $self->{rpcenv}; | |
133 | ||
134 | my $resp = { | |
135 | status => HTTP_NOT_IMPLEMENTED, | |
136 | message => "Method '$method $rel_uri' not implemented", | |
137 | }; | |
138 | ||
139 | my ($handler, $info); | |
140 | ||
141 | eval { | |
142 | my $uri_param = {}; | |
143 | ($handler, $info) = PVE::API2->find_handler($method, $rel_uri, $uri_param); | |
144 | return if !$handler || !$info; | |
145 | ||
146 | for my $p (sort keys %{$params}) { | |
147 | if (defined($uri_param->{$p}) && $uri_param->{$p} ne $params->{$p}) { | |
148 | raise_param_exc({ | |
149 | $p => "duplicate parameter (already defined in URI) with conflicting values!" | |
150 | }); | |
151 | } | |
152 | $uri_param->{$p} = $params->{$p}; | |
153 | } | |
154 | ||
155 | raise_perm_exc("URI '$rel_uri' not available with API token, need proper ticket.\n") | |
156 | if $auth->{api_token} && !$info->{allowtoken}; | |
157 | ||
158 | # check access permissions | |
159 | $rpcenv->check_api2_permissions($info->{permissions}, $auth->{userid}, $uri_param); | |
160 | ||
161 | if ($info->{proxyto} || $info->{proxyto_callback}) { | |
162 | my $node = PVE::API2Tools::resolve_proxyto( | |
163 | $rpcenv, $info->{proxyto_callback}, $info->{proxyto}, $uri_param); | |
164 | ||
165 | if ($node ne 'localhost' && $node ne PVE::INotify::nodename()) { | |
166 | die "unable to proxy file uploads" if $auth->{isUpload}; | |
167 | my $remip = $self->remote_node_ip($node); | |
168 | $resp = { proxy => $remip, proxynode => $node, proxy_params => $params }; | |
169 | return; | |
170 | } | |
171 | } | |
172 | ||
173 | my $euid = $>; | |
174 | if ($info->{protected} && ($euid != 0)) { | |
175 | $resp = { proxy => 'localhost' , proxy_params => $params }; | |
176 | return; | |
177 | } | |
178 | ||
179 | $resp = { | |
180 | data => $handler->handle($info, $uri_param), | |
181 | info => $info, # useful to format output | |
182 | status => HTTP_OK, | |
183 | }; | |
184 | ||
185 | if (my $count = $rpcenv->get_result_attrib('total')) { | |
186 | $resp->{total} = $count; | |
187 | } | |
188 | ||
189 | if (my $diff = $rpcenv->get_result_attrib('changes')) { | |
190 | $resp->{changes} = $diff; | |
191 | } | |
192 | }; | |
193 | my $err = $@; | |
194 | ||
195 | $rpcenv->set_user(undef); # clear after request | |
196 | ||
197 | if ($err) { | |
198 | $resp = { info => $info }; | |
199 | if (ref($err) eq "PVE::Exception") { | |
200 | $resp->{status} = $err->{code} || HTTP_INTERNAL_SERVER_ERROR; | |
201 | $resp->{errors} = $err->{errors} if $err->{errors}; | |
202 | $resp->{message} = $err->{msg}; | |
203 | } else { | |
204 | $resp->{status} = HTTP_INTERNAL_SERVER_ERROR; | |
205 | $resp->{message} = $err; | |
206 | } | |
207 | } | |
208 | ||
209 | return $resp; | |
210 | } | |
211 | ||
212 | sub check_cert_fingerprint { | |
213 | my ($self, $cert) = @_; | |
214 | return PVE::CertCache::check_cert_fingerprint($cert); | |
215 | } | |
216 | ||
217 | sub initialize_cert_cache { | |
218 | my ($self, $node) = @_; | |
219 | PVE::CertCache::initialize_cert_cache($node); | |
220 | } | |
221 | ||
222 | sub remote_node_ip { | |
223 | my ($self, $node) = @_; | |
224 | ||
225 | my $remip = PVE::Cluster::remote_node_ip($node); | |
226 | die "unable to get remote IP address for node '$node'\n" if !$remip; | |
227 | ||
228 | return $remip; | |
229 | } | |
230 | ||
231 | 1; |